Read the docs
TI-2026-29514 Aliases CVE-2026-40857GHSA-6v9q-56wf-hqwp

CSRF token bypass in T-Mobile 5G Box IDU routers

Priority LOW 38CWE-352Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Tampering
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.This issue has been fixed in firmware version 1.1.0.651412

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00197 9th percentileScored 2026-11-07
Fix Fixed T-Mobile 5G Box IDU (WNC): 1.1.0.651412

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WNCT-Mobile 5G Box IDUbefore 1.1.0.6514121.1.0.651412Patch availableCNA
  • T-Mobile 5G Box IDU VendorWNC Affected before 1.1.0.651412 Fixed in 1.1.0.651412 Patch available CNA

Remediation

  • Fix · CNA T-Mobile 5G Box IDU (WNC) Fixed in 1.1.0.651412

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WNC T-Mobile 5G Box IDU 1.1.0.651412

    6 records Highest priority Priority MEDIUM 4 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-41864 Unauthorized remote code execution in T-Mobile 5G Box IDU routersPriority MEDIUM 48
    • TI-2026-41865 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routersPriority MEDIUM 45
    • TI-2026-29512 Command Injection in T-Mobile 5G Box IDU router via ping functionalityPriority MEDIUM 45
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40857
  2. 2026-10-03 Alias added: GHSA-6v9q-56wf-hqwp

References

Advisory 1

  • TI-2026-41864 Unauthorized remote code execution in T-Mobile 5G Box IDU routers CVSS 4.0CRITICAL 9.4
  • TI-2026-41865 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers CVSS 4.0CRITICAL 9.3
  • TI-2026-29512 Command Injection in T-Mobile 5G Box IDU router via ping functionality CVSS 4.0CRITICAL 9.3
  • TI-2026-29511 Session auth bypass via cookie value in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 8.7
  • TI-2026-29513 Config disclosure in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences